New UK–US pact puts data and AI regulation front and centre
UK Prime Minister Rishi Sunak and US President Joe Biden signed a new agreement in early June designed to enhance economic relations between the UK and US. This ‘Atlantic Declaration’ covers various aspects of trade cooperation – with one area of focus being technology, including artificial intelligence (AI).
Since hopes of a comprehensive transatlantic trade deal still seem vanishingly remote in the wake of Brexit, smaller scale agreements such as this declaration and the previous AUKUS security pact between Australia, the UK and the US may be the best chance of formalising a trading partnership between the two nations in the short- to medium-term.
The Atlantic Declaration essentially sets out a series of sector-by-sector agreements on a range of matters, including on the regulation of AI; electric car manufacturing; defence procurement; data protection alignment; and the recognition of professional qualifications.
Commenting on the motivation behind this deal, Chris Holder, a Member of the IBA Technology Law Committee Advisory Board and a partner at Bristows in London, says that although ‘it is inevitable that, post Brexit, the UK is trying to forge greater economic ties with the US’, it’s not historically unusual because the transatlantic partners ‘have been cooperating together for over a century and this type of announcement does have precedent as the two countries have made joint declarations before’.
One of the notable technology-related proposals contained in the Atlantic Declaration is the establishment of a data protection framework, dubbed a ‘US–UK Data Bridge’, which would ‘facilitate data flows between [the US and UK] while ensuring strong and effective privacy protections’. In effect this would align data protection rules between the two countries, to allow data to flow freely and ensure seamless technology supply chains.
According to the official press release, establishing the Data Bridge will ‘make it easier for around 55,000 UK businesses to transfer data freely to certified US organisations without cumbersome red tape – translating into an estimated £92.4m in direct savings per year’.
If the Declaration can begin to draw parties together, then it would help the development of the AI industry globally
Chris Holder
Member, IBA Technology Law Committee Advisory Board
Adam Rose, Chair of the IBA Data Protection Governance and Privacy Subcommittee and a partner at Mishcon de Reya, says that although Brexit theoretically allowed the UK to form its own trade and data agreements with third countries, the ‘reality has been that, for the UK to maintain its trade relationship with the EU, it needs to remain broadly aligned with the EU's approach to data transfers to third countries, including – in particular – with the US. The data provisions of the Atlantic Declaration are an illustration of this: they come hot on the heels of the European Commission’s recent draft adequacy decision in relation to the US,’ which concluded that the US ensures an adequate level of protection – comparable to that of the EU – for personal data transferred from the EU to US companies under the new data privacy framework between the two jurisdictions.
What remains to be seen, says Rose, is whether the UK can broker data bridge deals with third countries that are not also already anticipated by or subject to Commission negotiations and, if it does, whether it will risk its own adequacy position and agreement with the European Commission.
He says that the proposed US–UK Data Bridge would be a formal mechanism, requiring UK secondary legislation, recognising the US – or, rather, a US framework under which specific companies would be approved – as having an adequate level of protection in place to permit personal data to flow freely to those companies from the UK. Rose believes it’s quite possible, though, that such a framework, and the very similar framework between the European Commission and the US, ‘will be vulnerable to legal challenge, as their predecessor frameworks have, although all sides have taken significant steps to strengthen underlying weaknesses’.
In the wake of transformative generative AI technologies such as ChatGPT and Stable Diffusion, governments around the world have been discussing the various societal and economic implications and grappling with the best ways of implementing regulations without stifling innovation. In May, a US Senate hearing explored the challenges posed by fast-moving advancements in AI technology, seeking the views of industry experts including Sam Altman, the Chief Executive of OpenAI – the company behind ChatGPT. Altman urged lawmakers to design and impose rules on technology companies that are developing AI tools, stating that ‘regulatory intervention by governments will be critical to mitigating the risks of increasingly powerful [AI] models’.
The Atlantic Declaration broaches the idea of mutual cooperation on AI regulation between the US and UK, emphasising a ‘focus on ensuring the safe and responsible development of the technology’. However, Rose highlights that it avoids the specific term ‘AI regulation’ and ‘is short on detail. Nonetheless, it recognises that any approach to such regulation needs to be considered on a global scale, and it refers for example to various initiatives of the OECD [Organisation for Economic Cooperation and Development], the United Nations, the Council of Europe and the G7 Hiroshima AI Process.’
The importance of a global approach to AI regulation is evident in the planned launch of a Global Summit on AI Safety, to be hosted in the UK later in 2023. The summit aims to bring together international political representatives, academics and technology companies, to explore ‘safety measures to evaluate and monitor risks from AI’ and help come up with regulatory solutions.
Image credit: Tierney/AdobeStock.com